Cross-platform registry browser for raw Windows registry files

ExeSpy is a cross-platform PE viewer for EXE and DLL files

Hands-on projects for beginners to learn and practice Windows forensics and essential cybersecurity skills

Vault of Windows Registry forensic artifacts

Command Spy is a utility for monitoring the command line arguments of new processes on Windows. Made for CCDC.

Python module for forensic analysis of Windows shortcuts (LNK files). You can install this package using pip install lnkanalyser

Tools and Techniques for Digital Forensics and Incident Response

When conducting an investigation on a Windows machine there are 8 phase to go through, today we’ll discuss the first ‘Collecting Volatile Information’, and the rest will be explained in future topics

RDP Bitmap Cache Praser A lightweight forensic utility to extract and reconstruct images from the RDP Bitmap Cache (bmc, bin, dat) files. Useful for identifying visual remnants of a remote desktop session, even after it ends. Ideal for forensic investigations and RDP activity analysis.

FAEP is an automated tool to extract and parse forensic artifacts from .E01 images automatically, with a clean GUI and minimal manual effort.

Gives you the list of storage devices that has been connected to your windows machine

The case illustrates the power of structured host-based triage — beginning with logs and EDR, and moving through file inspection, RAM capture, and finally, network artifact confirmation.

In this second case study of the structured IOC triage series, we examined a subtle but dangerous host-based compromise involving the abuse of the Windows utility `rundll32.exe` to execute a malicious DLL payload.

This journal documents my progress and learnings from different TryHackMe rooms. Each entry contains key takeaways, commonly used commands, and practical applications. My experience with TryHackMe has enhanced my understanding of Linux and Windows fundamentals, network protocols, incident handling, and log analysis.

Practical labs, case studies, and investigation notes for CHFI v11 — covering digital forensics, malware forensics, incident response, evidence collection, and analysis tools.

This repository documents real-world forensic triage cases involving the abuse of legitimate Windows binaries—also known as LOLBins—for malicious purposes.